CVE-2025-27511

Description

GeoServer is an open source server that allows users to share and edit geospatial data. Prior to version 2.27.0 of the GeoServer DB2 DataStore Extension, an administrator can perform a JNDI attack through specially crafted DB2 jdbc url leading to to Remote Code Execution (RCE). Version 2.27.0 fixes the issue.

Traduire en français

Produits concernés

• geoserver org.geoserver.extension:gs-db2
• Osgeo geoserver

Scores CVSS

Faiblesses (CWE)

• CWE-74
• CWE-502

Références

• https://github.com/geoserver/geoserver/releases/tag/2.27.0 ProductRelease Notes
• https://github.com/geoserver/geoserver/security/advisories/GHSA-g628-r368-6vh7 Vendor Advisory
• https://nvd.nist.gov/vuln/detail/cve-2023-27867 Not Applicable
• https://osgeo-org.atlassian.net/browse/GEOT-7725 Issue Tracking

Ailleurs

• NVD
• CVE.org
• CIRCL Vulnerability-Lookup
• CERT-FR
• GitHub Advisories